WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2017-08-31✕Vendor org.apache.struts✕
Overview 16 matches · 5 protected · 4 exploited · 1 CISA KEV · 6 public PoC · 6 EPSS ≥ 0.5
16matches 5protected31.2% 4exploited25.0% 1CISA KEV6.2% 6public PoC37.5% 6EPSS ≥ 0.537.5%
Protected by Waratek 5 31.2% Rule in development 0 0.0% Mitigation candidate 4 25.0% No exploit published 7 43.8%
Critical 0 0.0% High 16 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 31.2% partly blocked 0 0.0% not blocked 11 68.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 25.0% Working exploit published 2 12.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 10 62.5%
split by peak 5 / quarter
No exploit published: 7Mitigation candidate: 4Protected by Waratek: 5 High: 16 not blocked: 11blocked by ARMR today: 5 No public exploit: 10Working exploit published: 2Exploited: 4
Q1 121 No exploit published1 High1 not blocked1 No public exploit1 Q2 120 Q3 120 Q4 120 Q1 130 Q2 130 Q3 135 Protected by Waratek1 Mitigation candidate3 No exploit published1 High5 blocked by ARMR today1 not blocked4 Exploited2 Working exploit published2 No public exploit1 Q4 130 Q1 140 Q2 141 Mitigation candidate1 High1 not blocked1 Exploited1 Q3 140 Q4 140 Q1 150 Q2 150 Q3 151 No exploit published1 High1 not blocked1 No public exploit1 Q4 150 Q1 160 Q2 162 Protected by Waratek1 No exploit published1 High2 blocked by ARMR today1 not blocked1 Exploited1 No public exploit1 Q3 164 Protected by Waratek3 No exploit published1 High4 blocked by ARMR today3 not blocked1 No public exploit4 Q4 160 Q1 170 Q2 170 Q3 172 No exploit published2 High2 not blocked2 No public exploit2
Q1 12Q3 12Q1 13Q3 13Q1 14Q3 14Q1 15Q3 15Q1 16Q3 16Q1 17Q3 17
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2015-5209 High 2017-08-29 No exploit published No public exploit Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
CVE-2017-9787 High 2017-07-13 No exploit published No public exploit When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
CVE-2016-4431 High 2016-07-04 No exploit published No public exploit Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
CVE-2016-1182 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
CVE-2016-1181 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
CVE-2015-0899 High 2016-07-04 Protected by Waratek No public exploit The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
CVE-2016-3081 High 2016-04-26 Protected by Waratek Exploited Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2016-0785 High 2016-04-12 No exploit published No public exploit Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
CVE-2015-1831 High 2015-07-16 No exploit published No public exploit The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
CVE-2014-0113 High 2014-04-29 Mitigation candidate Exploited CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
CVE-2013-2135 High 2013-07-16 No exploit published No public exploit Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
CVE-2013-2134 High 2013-07-16 Mitigation candidate Exploited Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
CVE-2013-2115 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVE-2013-1966 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
CVE-2013-1965 High 2013-07-10 Protected by Waratek Exploited Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
CVE-2012-0838 High 2012-03-02 No exploit published No public exploit Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.